Release Date

• 2017-06-30

New Features

• Code Review: added new reviewers logic. This features now is Common Criteria compatible and allows to define Mandatory (non-removable) reviewers. In addition new options were added to forbid adding new reviewers or forbid author of commits or the pull request itself to be a reviewer of the code.
• Audit logs: introducing new audit logs tracking most important actions in the system. Admins can track important events such as deletion of resources, permissions changes, user groups changes. Each event tracks users with his IP and user agent.
• Mercurial: enabled evolve extensions. Each repository can be now configured to support evolve, commit phases, and evolve state are also shown in commit and changelog views.
• VCS: expose newly pushed bookmarks or branches as quick links to open a pull request on client output. Allows easier pull request creation via CLI.

General

• Core: ported many views into pure pyramid code with python3.6 compatibility. Now almost 80% of the code is ported, and future ready. It's our ongoing effort to allow support for modern python version.
• Comments: show author tag in pull request comments to easily discover the author of changes in discussions.
• Files: allow specifying custom filename for uploaded files via web interface.
• Pull requests: changed who is allowed to close a pull request. Now it's only super-admin, owner or person who can merge. Before it was every reviewer can close. Which really doesn't make sense.
• Users: show that user is disabled when editing his properties.
• Integrations: expose user_id, and username in Webhook integration templates arguments.
• Integrations: exposed extra repo variables in template arguments of Webhook integration.
• Login: add link when using external auth to make it easier to login using oauth providers, such as Google or Github.
• Maintenance: added svn verify command to tasks to be able to verify the filesystem and repo formats from web interface. Allows much easier tracking of incompatible filesystem storage of subversion repositories.
• Events: expose permalink urls for pull requests, and repositories. Permalink url should provide a non-changeable url that can be used in external system.
• Svn: increase possibility to specify compatibility to pre 1.9 version.

Security

• security(high): fixed possibility to delete other users inline comments for users who were repository admins.
• security(med): fixed XSS inside the tooltip for author string.
• security(med): fixed stored XSS in notifications inbox.
• security(med): use custom writer for RST rendering to prevent injection of javascript: tags.
• security(med): escape flash messaged VCS errors to prevent reflected XSS attacks.
• security(low): use 404 instead of 403 code on permission decorator to prevent brute force resource discovery attacks.
• security(low): fixed self XSS inside autocomplete files view.
• security(low): fixed self Xss inside repo strip view.
• security(low): fixed self Xss inside the email add functionality.
• security(none): use new safe escaped user attributes across the application. Will prevent all possible XSS attack vectors from user stored attributes. This specially can come from external authentication systems which doesn't validate the data.

Performance

Fixes

• Pull requests: make sure we process comments in the order of IDS when linking them. In some edge cases it could lead to comments not displaying correctly.
• Emails: fixed newlines in email templates that can break email sending code.
• Markdown: fixed hr and strong tags styling.
• Notifications: fixed problem with 500 errors on non-numeric entries in url.
• API: use simple schema validator to be consistent how we validate between API and web views for create user and create user_group calls.
• Users: fixed problem with personal repo group wasn't shown for disabled users.
• Oauth: improve Google extraction of first/last name from returned data.

Upgrade notes

• API: the update_pull_request method will no longer support a close action. Users should use the existing close_pull_request method which allows specifying a message and status while closing a pull request.